RE: [malware-list] [RFC 0/5] [TALPA] Intro to alinuxinterfaceforon access scanning

Press, Jonathan
2008-08-14T18:37:39Z

> -----Original Message-----
> From: Pavel Machek [mailto:pavel@suse.cz]
> Sent: Thursday, August 14, 2008 8:54 AM
> To: tvrtko.ursulin@sophos.com
> Cc: Arjan van de Ven; Adrian Bunk; davecb@sun.com; Greg KH; Press,
Jonathan;
> linux-kernel@vger.kernel.org; linux-security-module@vger.kernel.org;
malware-
> list@lists.printk.net; Mihai Don??u
> Subject: Re: [malware-list] [RFC 0/5] [TALPA] Intro to
alinuxinterfaceforon access
> scanning
>
> Hi!
>
> Okay, so goal of libmalware.so is to "not allow data in the black list
> to pass through Linux server". Threat model is windows machines trying
> to copy infected files through the server.

That's only part of the threat model.

> Viruses are not expected to have shell access to either root or normal

> users on the server.

That's a big exception.

> it actually _works_, 100% of time, for apps using it.

Again that's a big condition.

Jon Press